In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.

ubuntu_linux USN-8887-1: Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)

ubuntu_linux USN-8889-1: Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

ubuntu_linux USN-8888-1: Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range
    source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices")
    allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb
    copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that
    implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs.
    The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb
    copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the
    same base fs, the copy operation on the two real files from two different overalyfs filesystems is
    performed with the mounter creds of the destination overlayfs and the read permission access hook for the
    source file was called with the wrong creds. This could cause either deny of access to copy which would
    otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix
    the latter case by explicitly verifying read access to source file with the source overlayfs mounter
    creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to
    regular copy so no harm done. (CVE-2026-68448)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed     in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled     properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource     when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size     512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff     ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........
    .V..... backtrace (crc be7cba35): [<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420     [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0     [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920     [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0     [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0     [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on     matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow     of the function reconnects the matcher back and returns an error, which continues running the calling     function and eventually frees the matcher that is being disconnected. This leads to a case where we have a     freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch     fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note     that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering     state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case     with any other error handling during resource destruction. However, the goal here is to allow the driver     to continue and not crash the machine with use-after-free error. (CVE-2025-21751)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while     enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone     monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor     destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone     monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver     updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is     activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to     HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring,     and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for     the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory     leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc     for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone monitor     mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly     when enabling standalone monitor mode in the future. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed     in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled     properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource     when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size     512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff     ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........
    .V..... backtrace (crc be7cba35): [<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420     [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0     [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920     [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0     [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0     [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on     matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow     of the function reconnects the matcher back and returns an error, which continues running the calling     function and eventually frees the matcher that is being disconnected. This leads to a case where we have a     freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch     fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note     that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering     state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case     with any other error handling during resource destruction. However, the goal here is to allow the driver     to continue and not crash the machine with use-after-free error. (CVE-2025-21751)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while     enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone     monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor     destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone     monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver     updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is     activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to     HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring,     and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for     the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory     leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc     for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone monitor     mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly     when enabling standalone monitor mode in the future. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c (vfs: allow     copy_file_range to copy across devices) allowed filesystems that implement the copy_file_range() f_op to     decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to     verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at     the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs     and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy     when the two underlying files are on the same base fs, the copy operation on the two real files from two     different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the     read permission access hook for the source file was called with the wrong creds. This could cause either     deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file     which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file     with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but     userspace could fall back to regular copy so no harm done. (CVE-2026-68448)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
470767	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
470767	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
470332	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
470332	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
352548	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Alma Linux Local Security Checks	Local	high
352273	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Rocky Linux Local Security Checks	Local	high
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
334897	Linux Distros Unpatched Vulnerability : CVE-2026-68448	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-68448

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

high

high

high

high

medium